Letta ImageContent file:// Local File Read Bypass
Older versions of the Letta agent server accepted 'file://' links inside image attachments without checking the scheme. An attacker could send a request with an image field pointing at a local file like /etc/passwd, and the server's image parser would read and return that file's contents.
How the attack works
An attacker sends a normal-looking API request to the Letta server that includes an ImageContent or image_url object. Instead of a real image URL, the value is a file:// path pointing somewhere on the server's filesystem. Because Letta Server versions before 0.16.7 did not validate the URL scheme, the image-loading code treated the local path as a legitimate image source and read the file. The response or downstream processing can then expose that file's contents to the attacker. The rule traces the process that made this request and follows its child/sibling processes to see if any of them actually read a file as a result, tying the file read back to the specific request that triggered it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f2d1c94-83ab-4d1e-9b0c-2a7f5e41d8c3
- Severity
- High
Why it matters
An attacker can read arbitrary files on the host running the Letta server, potentially exposing credentials, configuration, or other sensitive data that has nothing to do with the agent's normal purpose.
What you can do
- →Upgrade Letta Server to 0.16.7 or later, which rejects file:/// URLs in image content.
- →If upgrading isn't immediately possible, add a proxy or input filter that rejects non-http(s) schemes in image_url/ImageContent fields before they reach the server.
- →Review server logs for past requests containing file:// URLs in image fields to check for prior exploitation.
- →Run agent servers with least-privilege filesystem access so a successful read exposes as little as possible.
Known benign look-alikes
- Local multimodal development workflow where a developer tool posts an image by local path (file:///Users/me/shot.png) to a self-hosted agent server running on the same machine. The rule reports rather than blocks so an operator can confirm intent.
- SDK examples, integration tests or documentation payloads that POST a sample ImageContent object containing a file:///path/to/image.png reference.
- A pasted log line or error message containing a file:// URL inside the same request body as an unrelated image attachment. Mitigated by requiring the URL to sit within 400 bytes before / 200 bytes after an image-content marker.
- The corroboration stage can attach a READ_FILE row produced by unrelated tooling in the same process lineage; it only attaches when the read path matches the exact referenced path or its basename inside the 10 minute window, and it never gates the verdict on its own.